Law / Ukraine

Draft Law No. 8153, automated decision making and data subject rights

Draft Law No. 8153, arts. 18, 25 (automated decision making disclosure and data subject rights: erasure, restriction, portability)

A citation is an address, not a summary. The first part names the law; what follows narrows it to the exact section, article or paragraph.

What follows is LexLint's own research summary of this law, not legal advice.

Proposed: draft date not recorded.

A data subject rights rule binding public and private bodies.

As of 19 September 2026.

What it requires

This draft has passed only a first reading and is not yet law; no automated decision making or data subject rights duty currently attaches to it, and the following describe what enactment would require.
Once enacted, disclose your automated decision making mechanisms to a data subject in Ukraine, under Article 18.
Once enacted, do not base a decision that significantly affects a data subject in Ukraine solely on automated processing, including profiling, under Article 25.
Once enacted, give a data subject in Ukraine the right to erasure of their personal data.
Once enacted, give a data subject in Ukraine the right to restriction of processing of their personal data.
Once enacted, give a data subject in Ukraine the right to receive their personal data in a portable format.

What it reaches

Obligation class

Data subject rights, Disclosure

What this law does

Drafted with AI from the cited sources under the direction of UnGovr staff. UnGovr holds editorial responsibility for this page.

Draft Law No. 8153 would add rights the current 2010 law does not carry in this form. Article 18 would require a controller to disclose its automated decision making mechanisms to a data subject, and Article 25 would prohibit a decision that significantly affects a data subject if that decision is based solely on automated processing, including profiling.

The draft would also add a right to erasure, a right to restriction of processing, and a right to data portability; the current law's own access, objection, rectification, and automated decision protections are recorded on the sibling instrument ua-zakon-ukrainy-pro-zakhyst-personalnykh-danykh in this file. None of this binds today: the draft has passed only a first reading and remained in second reading preparation as of the most recent source located, dated May 2026.

When LexLint raises it

crawls_web
trains_models
deploys_chatbot
automated_outreach
high_risk_decisions
generates_content

Read the law

recordinglaw.com
"Ukraine Data Privacy Laws: Personal Data Protection, Draft Law 8153, and the GDPR Reform," read in full (41,934 characters, not truncated)

Every line above is drawn from the primary source linked here, read on the date shown. This is a research summary, not legal advice.

Back to the example · Lint your app